CVE-2025-52497 | THREATINT

Description

Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.

Reserved 2025-06-17 | Published 2025-07-04 | Updated 2025-07-04 | Assigner mitre

MEDIUM: 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Problem types

CWE-193 Off-by-one Error

Product status

Default status

unaffected

Any version before 3.6.4

affected

References

github.com/...isories/mbedtls-security-advisory-2025-06-2.md

cve.org (CVE-2025-52497)

nvd.nist.gov (CVE-2025-52497)

Download JSON